Notorious North Korean Hackers Blamed for $1.5bn ByBit Heist

US officials have agreed with blockchain analysts that blamed North Korea for the theft last week of about $1.46 billion in digital assets from ByBit cryptocurrency exchange.

Analysts from the Elliptic blockchain analysis firm said on Saturday they had linked the hack – believed to be the largest crypto heist ever, and perhaps the “largest single theft of any kind, ever” – to Lazarus Group, a state-backed unit notorious for siphoning billions from the sector.

The Lazarus Group is infamous for targeting security vulnerabilities to fund the North Korean regime over the past decade or more.

ALSO SEE: 810,000 Investors Have Lost Over $2 Billion on Trump Coin – NYT

Largest crypto thefts (Elliptic graphic, Tom Robinson, LinkedIn February 22, 2025).

Elliptic chief scientist and co-founder Tom Robinson posted on LinkedIn on Saturday: “Almost $1.5 billion in crypto was stolen from Bybit today. That makes it by far the largest crypto heist of all time. It’s also potentially the largest single theft of any kind, ever.

“We’re working to help exchanges and law enforcement to trace and freeze these funds. The more difficult we make it to benefit from crimes such as this, the less frequently they will take place.”

‘TraderTraitor’

The Federal Bureau of Investigation (FBI) said it refers to this specific North Korean malicious cyber activity as “TraderTraitor,” according to Reuters.

“TraderTraitor actors are proceeding rapidly and have converted some of the stolen [ether] assets to bitcoin and other virtual assets dispersed across thousands of addresses on multiple blockchains,” it said in a public service announcement on Wednesday February 26.

The FBI said it is expected the assets will be further laundered and eventually converted to fiat currency.

ByBit said on Friday an attacker gained control of an ether wallet and transferred the holdings to an unidentified address.

The exchange caters to more than 60 million users worldwide and offers access to various cryptocurrencies, including bitcoin and ether.

The breach sparked a rush of withdrawals from Bybit as users feared potential insolvency. ByBit CEO Ben Zhou said later that outflows had stabilized, and announced that Bybit had secured a bridge loan from undisclosed partners to cover any unrecoverable losses and maintain operations, according to a report by CNBC.